> people that have the skills to execute on them are rare

This is the limiting factor in secure coding. We need more efficient ways of scaling out the few teams doing top tier work, as it only takes a single bad code review to open a security hole.

Teams should not need to implement their own authentication mechanism. Most companies should not need to implement their own mechanism. Authentication providers should explicitly and automatically verify that their clients have implemented auth correctly.